FA 5_Privacy and Information Management_DRAFT PWS.pdf

U.S. Department of Health and Human Services Office of the Chief Information Officer

Privacy and Information Management Support Services – Functional Area 5

Performance Work Statement

Sources Sought Notice 75P00120R00010

Privacy and Information Management Support Services FA 5 DRAFT PWS

Privacy and Information Management Support Services Functional Area Scope

The Office of Privacy and Information Management (PIM) supports an enterprise-wide secure and trusted environment in support of HHS' commitment to better health and well-being of the American people.

PIM implements a comprehensive, enterprise-wide privacy and information management program to protect the critical information, including personally identifiable information (PII), with which the Department is entrusted. This includes overseeing Privacy Impact Assessments (PIAs), Breach Response, Records Management, Paperwork Reduction Act, and Policy & Strategy. The Contractor shall provide privacy support services to effectively administer, manage, and perform the duties and responsibilities as defined in this PWS. The scope of work under this PWS includes the following tasks:

The scope of work under this PWS includes the following tasks:

1. Task Transition Management

2. Task Management

3. PIM - Program Management Support

4. PIM - Breach Response Management; and

5. PIM - Privacy Impact Assessments (PIAs)

6. PIM - Privacy Policy & Strategy

7. PIM - Privacy Training and Awareness

8. Surge Support

Regulatory References (not all inclusive)

• HHS Policy for Information Technology (IT) Enterprise Performance Lifecycle Management (EPLC): https://www.hhs.gov/sites/default/files/eplc-policy-dec-2016.pdf

• The Federal Information Technology Acquisition Reform Act (FITARA):

https://www.congress.gov/113/plaws/publ291/PLAW-113publ291.pdf#page=148%5D

• National Institute of Standards and Technology (NIST) Cybersecurity Framework:

https://www.nist.gov/cyberframework

• The Federal Risk and Authorization Management Program (FedRAMP):

https://www.fedramp.gov/

• Federal Architectures Framework (FAEF 2.0):

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2

• OMB Circular A-130, Managing Information as a Strategic Resource:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdfHHS Cybersecurity Overview:

https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html

• Executive Orders 13636 and 13691, PPD-21:

o EO 13636: https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity o EO 13691: https://obamawhitehouse.archives.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari o PPD-21: https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil https://www.hhs.gov/sites/default/files/eplc-policy-dec-2016.pdf https://www.congress.gov/113/plaws/publ291/PLAW-113publ291.pdf#page=148%5D https://www.nist.gov/cyberframework https://www.fedramp.gov/ https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2 https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil

• National Initiative for Cybersecurity Education (NICE) Workforce Framework:

https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework

• Presidential Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure: https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure

• NIST Special Publication (SP) 800-37 Rev.2 : Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy:

https://csrc.nist.gov/news/2018/rmf-update-nist-publishes-sp-800-37-rev-2

• OMB Circular A-123: Management’s Responsibility for Enterprise Risk Management and Internal Control:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf

• OMB M-19-03, Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program: https://www.whitehouse.gov/wp-content/uploads/2018/12/M-19-03.pdf

• E-Government Act of 2002: https://www.govinfo.gov/content/pkg/PLAW- 107publ347/pdf/PLAW-107publ347.pdf

• Privacy Act of 1974: https://www.govinfo.gov/content/pkg/USCODE-2012-title5/pdf/USCODE- 2012-title5-partI-chap5-subchapII-sec552a.pdf https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforce-framework https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://www.dhs.gov/cisa/executive-order-strengthening-cybersecurity-federal-networks-and-critical-infrastructure https://csrc.nist.gov/news/2018/rmf-update-nist-publishes-sp-800-37-rev-2 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m-16-17.pdf

TASK 1: TRANSITION

The Contractor will oversee all Transition-related work streams including, but not limited to:

a. Assume responsibility for the various areas of support from incumbent contractors currently providing services under this Task. Sustain consistent operational delivery. Appropriately capture qualified incumbent workforce.

b. Achieve 90% of agreed staffing capacity and complete transition in accordance with the proposed transition plan for all areas of support within 60 days from award.

TASK 2: TASK MANAGEMENT

The Contractor shall be responsible for the effective management and administration of the resulting Task, ensuring that all work activities associated with tasks or projects are performed in a timely and cost effective manner while maintaining the highest quality of performance.

The Contractor Shall:

a. Ensure that the cross-functional areas of support are managed in a manner that achieves the objectives identified in the Objectives Section.

b. Develop and execute a Task Management Plan that reflects the interdependencies of the various staffing areas. Maintain no less than 90% of agreed staffing capacity through the life of the contract.

c. Task Management Plan elements include, but are not limited to:

i. Team organization and management to include a staffing plan, staff training, and management of staffing changes. The staffing plan must address Key Personnel positions and the process for overseeing, controlling, and delivering required services under the Task;

ii. Management and control of a Work Breakdown Structure (WBS), schedules, cost, and

iii. Task requirements;

iv. Reporting, documenting, and managing problems, changes, risks, mitigation plans, and recommendations;

v. Communication and escalation procedures, general operating procedures, transition plans, and any additional information the contractor deems relevant; and

vi. Task deliverables and acceptance process, distribution lists, format, and schedules for Government review and acceptance.

d. Work closely with the Agency staff to develop information to be included in the Draft Task

Management Plan.

e. Submit a Draft Task Management Plan within fifteen (15) business days after award and a final Plan is due ten (10) days after receipt of PIM feedback.

f. Conduct a quarterly review for changes must also be performed with revisions due by the

15th day after each quarter ends.

g. Meet with the Government COR within ten (I0) business days after award to establish a review process for the Performance Requirements Summary (PRS) to be implemented by the second month of the contract.

h. Provide a final approved review process incorporated into the Quality Assurance Plan (QAP) and Task Management Plan with quarterly reporting established.

i. Provide a schedule for development and implementation approved by the COR.

j. Provide a draft QAP within fifteen (15) business days after award and a final QAP is due ten

(10) business days after of receipt of OIS feedback. QAP elements include, but are not limited to: addressing how the contractor will ensure the objectives of the Task will be met as well as methodologies for correction of deviations and the records to be kept for inspections.

k. Conduct a quarterly review for changes that may impact the QAP must also be performed and submitted with the updated Task Management Plan by the fifteenth (15th) of the month following the end of each quarter.

l. Deliver a monthly Task Performance Report (TOPR) that provides valid and timely program status information to the designated PIM point(s) of contact no later than the 10th business day of each month for the prior month. The TOPR shall include the following:

i. Work performed during the reporting period including: accomplishments, problems/issues, key decisions with impacts, and recommendations for corrections;

ii. Work to be accomplished during the next reporting period;

iii. Ad hoc information on project status on an as-needed basis;

iv. Any issues that may occur during project implementation, to include external dependencies;

v. Performance measurements against PRS; and

vi. Staffing list, organizational chart, and vacancy status.

m. Prepare and maintain a Funds and Expenditure Report (F &E) to include, at a minimum:

CLIN, SubCLIN (where applicable), labor category, personnel charging, hours, expenditures, current period and cumulative totals, funding amount, remaining balance, estimate to complete by month and estimate at completion.

n. Prepare and maintain an F&E in a format that is approved by the Government.

o. Develop an F&E report with elements that include, but are not limited to: show total contract value, total expended and variance analysis from the prior month's estimates, utilizing planned value and/or forecasting amounts against actual monthly expenditures for analyses.

p. Develop an F&E report structure that ties to a CLIN and SubCLIN and/or WBS elements where applicable for the given Task.

q. Submit an F&E report to the Contracting Officer Representative (COR) electronically by the 10th business day of each month for the prior month.

r. Provide the Government with options at every phase and/or critical milestone in a project and ensure Federal staff make all final project decisions.

s. Forecast decisions required decision making for Federal staff.

t. Determine actions that can be performed by contractor employees to ensure their discretionary decisions remain subject to Government oversight and final approval.

u. Address issues in advance and ensure conclusions are reflected in the contract by the contractor’s administration.

v. Ensure that contractor employees are properly identified in email communications, teleconference calls, and in meetings so that all participants can differentiate between Federal employees and contractors.

TASK 3: PIM - PROGRAM MANAGEMENT SUPPORT

The Contractor will oversee all PIM-related work streams including, but not limited to: privacy breach response, Privacy Impact Assessments, privacy program training initiatives, privacy policy, privacy tool training and implementation and privacy program reporting. PIM program reporting includes, but is not limited to, Federal Information Security Modernization Act (FISMA) audits, General Accountability Office (GAO) audits, Inspector General (IG) audits, etc.).The Contractor shall identify a Program Manager (PgM) who will oversee all aspects of the Task.

The Contractor Shall:

a. Develop and execute plans to identify and communicate privacy risk factors and best practices across HHS and OpDivs.

b. Perform other duties as assigned at the direction of PIM leadership, to include reviewing privacy-related policies, guidance, training, and other deliverables; supporting PIM events;

and collaborating with Departmental, OpDiv, and external parties on privacy-related initiatives.

c. Develop internal and external reports related to PIM work streams, including PIA and breach response metrics.

d. Oversee and review all Contractor workstream deliverables.

TASK 4: PIM – BREACH RESPONSE MANAGEMENTPIM Breach Response provides privacy breach response management throughout the HHS privacy breach management process. The privacy breach response process assesses and mitigates the potential risks of the unauthorized access, use, or disclosure of (PII).

The Contractor Shall:

a. Collect, document, track and monitor all privacy breaches from inception to closure.

b. Conduct initial risk analysis of all privacy breaches determining mitigation strategies.

c. Identify and elevate high profile incidents to PIM leadership

d. Develop weekly breach response report submitted to PIM Federal Staff for PIM leadership approval.

e. Maintain and update database of privacy breaches to include category type, response timeliness, and mitigation actions that resulted in closure of the breach.

f. Document identified privacy breach mitigation strategies and next steps for all privacy breaches and communicate in writing to OpDivs in the Weekly Breach Response Report and OpDiv communications.

g. Coordinate weekly and monthly meetings of the Privacy Incident Response Team (PIRT), including meeting materials.

h. Update Privacy Incident/Breach Response Management documentation to include, but not limited to: Standard Operating Procedures, Charters, Guidance Documents, etc.

i. Support the development and implementation of new breach response tools, such as RSA Archer version 6.4 and 6.5, as necessary

j. Manage breach-related communications in the PIM mailbox (filing, tracking, monitoring, organizing, addressing privacy inquiries promptly, and escalating high profile issues).

k. Develop internal and external PIM reports derived from PIA and breach tracking tools, including internal spreadsheets and RSA Archer version 6.4 and 6.5.

l. Perform other duties as assigned at the direction of PIM leadership, to include reviewing privacy-related policies, guidance, training, and other deliverables; supporting PIM events;

and collaborating with Departmental, OpDiv, and external parties on privacy-related initiatives.

TASK 5: PIM – PRIVACY IMPACT ASSESSMENTS (PIAs) The PIM Privacy Impact Assessment team provides guidance, reviews and approves PIAs across the Department. PIAs assess and document the risks and effects of creating, collecting, using, maintaining, disclosing, and disposing of PII.

The Contractor shall:

a. Provide end-to-end PIA support; tracking of incoming PIAs; training; forecasting;

reviewing; final signing; 508 compliance; and posting of PIA submissions.

b. Train and provide guidance or feedback to OpDiv privacy programs and PIA authors on the PIA process and specific PIAs.

c. Assist in the ongoing development and implementation of PIA workflow and reporting capability.

d. Develop internal and external PIM reports derived from PIA and breach tracking tools, including internal spreadsheets and RSA Archer version 6.4 and 6.5.

e. Update and manage PIA review and approval records.

f. Strengthen PIA process for HHS at OpDiv and Department level (workflow, monitoring, reporting, processing, etc.).

g. Update PIA documentation to include, but not limited to: Standard Operating

Procedures, Writers Guides, Guidance, and Training Documents, etc.

h. Manage PIA-related communications in the PIM mailbox (filing, tracking, monitoring, organizing, addressing privacy inquiries promptly, and escalating high profile issues).

i. Perform other duties as assigned at the direction of PIM leadership, to include reviewing privacy-related policies, guidance, training, and other deliverables;

supporting PIM events; and collaborating with Departmental, OpDiv, and external parties on privacy-related initiatives.

TASK 6: PIM – PRIVACY POLICY & STRATEGY

The PIM Privacy Policy branch continues to establish and refine privacy and information management policies, incorporating new and emerging federal laws, Office of Management and Budget (OMB) requirements and National Institute of Standards and Technology (NIST) guidance, while also accounting for best practices and emerging threats and technologies. PIM Privacy Policy works across HHS OCIO, OpDivs, Staff Divs and external Federal agencies on documents, requirements, and standards.

The Contractor shall:

a. Collaborate with OCIO, OpDiv, and StaffDiv staff to identify HHS policy and guidance gaps.

b. Develop new HHS privacy policies, guidance, procedures, memoranda, and standards.

c. Regularly review and update existing policies, procedures, memoranda, and standards.

d. Support other PIM work streams in the development of guidance, standard operating procedures, and other materials.

e. Provide Subject Matter Expert (SME) support for the development of trainings.

f. Maintain a comprehensive privacy policy tracking mechanism.

g. Perform other duties as assigned at the direction of PIM leadership, to include reviewing privacy-related policies, guidance, training, and other deliverables; supporting PIM events;

TASK 7: PIM – PRIVACY TRAINING AND AWARENESS

The PIM Training and Awareness program works closely with SMEs across all work streams to develop training and awareness materials and resources, such as online and classroom presentations, job aids, posters, etc.

The Contractor shall:

a. Continue to implement and mature HHS’ existing training and awareness capabilities, working to address the needs of HHS’ workforce while maximizing the use of HHS training delivery services.

b. Work with HHS OCIO training and PIM teams to develop, program and update training course content for HHS security and privacy courses in the HHS Learning Management System (LMS)-compatible format. Please note HHS currently uses Saba 7.2 Enterprise version and is planning to upgrade to Saba 7.6 in June 2019. The contractor shall work with the most current version/software for HHS LMS

c. Develop, execute, and/or assist with privacy program campaigns and stakeholder outreach initiatives, including awareness events

d. Lead training tools and associated documentation for the new PIA tool and breach response tool, RSA Archer version 6.4 and 6.5, with different versions for HHS PIM and OpDivs.

e. Assist PIA, policy, and breach response work streams with development of standard operating procedures, writer’s guides, guidance, etc.

f. Update the HHS PIM web and online presence, as necessary

g. Develop and execute communication and training plans.

h. Perform other duties as assigned at the direction of PIM leadership, to include reviewing privacy-related policies, guidance, training, and other deliverables; supporting PIM events;

TASK 8: Surge Support Mission needs combined with available funding may evolve as the contracted work is executed. At times additional hours and support may be needed within the overall scope of the Task. The Government may exercise increased hours for a specified labor category to provide additional support to meet the government's needs. This additional support will be temporary in nature and would only extend to end of the contract period.